Click here to Skip to main content
15,893,644 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
Hi,

I'm creating a Homepage for a website and I've stumbled in a small feature.

So I'm using a database (SQL) to save my users.
I'm throwing some alt and hashing their passwords but then my problem comes.

If the user attempts to change his password,
I ask him to insert his older password, his new and confirm his new.

Yet since the passwords are hashed and salted they don't match and my stored procedure in SQL returns -2.

ALTER PROCEDURE [dbo].[spChangePassword]
(
        @sUsername varchar(50),
	@sPasswordNew varchar(100),
	@sPasswordNewSalt varchar (128),
	@sPasswordNew varchar (100),
	@sPasswordNewSalt varchar (128),
)
AS
BEGIN
	SET NOCOUNT ON;
	
    if (exists (select 1
                from USERS
	        where Username = @sUsername 
                and Password = @sPasswordOld))
				
    begin
		if (exists (select 1
					from USERS
					where Username = @sUsername
					and Password != @sPasswordNew))

			begin
				select 1;
				 
				update BLC_USER
				set Password = @sPasswordNova,
				Password_Salt = @sPasswordNewSalt,
				where Username = @sUsername;
			end	

		 else
				select -1; -- New Pass = Old Pass, please chnage
	end
	else
		select -2; -- Old Pass is wrong
END


Am I doing something wrong in regards to the hashing passwords?
How can I compare two salted passwords?

Cheers,
Zamuk
Posted
Comments
Kornfeld Eliyahu Peter 13-Oct-14 14:57pm    
How do you check an existing password upon login?
[no name] 13-Oct-14 14:59pm    
http://www.codeproject.com/Questions/828839/How-to-change-password-from-database?arn=0

1 solution

When a user first sets their password you hash the password through C# and then store that value in the database.

When they want to change the password, you hash in C# the value they put in for current password and then you read the hash from sql and compare the hash values to see if they are the same.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900